{
  "schema_version": "1.0",
  "default_policy": {
    "require_https": true,
    "custom_hosts": "deny-by-default",
    "review_rule": "Network-capable scripts must declare allowed_hosts and justify any explicit custom-host override."
  },
  "scripts": {
    "scripts/check_update.py": {
      "purpose": "Check the public yao-meta-skill GitHub source for a newer VERSION or manifest version.",
      "allowed_hosts": [
        "raw.githubusercontent.com"
      ],
      "allowed_path_prefixes": [
        "/yaojingang/yao-meta-skill/"
      ],
      "requires_https": true,
      "custom_url_policy": "explicit-opt-in-only via --allow-custom-update-url or YAO_ALLOW_CUSTOM_UPDATE_URL=1",
      "timeout_seconds": 3,
      "auth": "none"
    },
    "scripts/github_benchmark_scan.py": {
      "purpose": "Search public GitHub repositories and fetch README excerpts as benchmark references for skill creation.",
      "allowed_hosts": [
        "api.github.com"
      ],
      "allowed_path_prefixes": [
        "/search/repositories",
        "/repos/"
      ],
      "requires_https": true,
      "custom_url_policy": "not supported",
      "timeout_seconds": 15,
      "auth": "optional GITHUB_TOKEN or GH_TOKEN for GitHub API rate limits"
    },
    "scripts/provider_output_eval_runner.py": {
      "purpose": "Call a reviewed OpenAI Responses API compatible endpoint to collect provider-backed output-eval model evidence.",
      "allowed_hosts": [
        "api.openai.com"
      ],
      "allowed_path_prefixes": [
        "/v1/responses"
      ],
      "requires_https": true,
      "custom_url_policy": "only via --provider-base-url plus --allow-custom-base-url; plain HTTP is restricted to --allow-insecure-localhost for local test servers",
      "timeout_seconds": 60,
      "auth": "OPENAI_API_KEY by default, or a reviewed env var through --api-key-env"
    }
  }
}